Debian GNU/Linux Advisories: kernel et al

Debian Security Advisory DSA 417-1	security@debian.org
http://www.debian.org/security/	Martin Schulze
January 7th, 2004	http://www.debian.org/security/faq

Package	:	kernel-patch-2.4.18-powerpc, kernel-image-2.4.18-1-alpha
Vulnerability	:	mising boundary check
Problem-Type	:	local
Debian-specific	:	no
CVE ID	:	CAN-2003-0985

Paul Starzetz discovered a flaw in bounds checking in mremap()
in the Linux kernel (present in version 2.4.x and 2.6.x) which may
allow a local attacker to gain root privileges. Version 2.2 is not
affected by this bug.

For the stable distribution (woody) this problem has been fixed
in version 2.4.18-1woody3 for the powerpc architecture.

For the unstable distribution (sid) this problem will be fixed
soon with newly uploaded packages.

We recommend that you upgrade your kernel packages. This problem
has been fixed in the upstream version 2.4.24 as well.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.dsc

Size/MD5 checksum: 664 fcb4f5a949cd17a2b528762db8c4a33e

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.diff.gz

Size/MD5 checksum: 67239 0ff7d0053ffbf71a66290081300ff759

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18.orig.tar.gz

Size/MD5 checksum: 29818323 24b4c45a04a23eb4ce465eb326a6ddf2

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-alpha_2.4.18-12.dsc

Size/MD5 checksum: 876 a419849800dab82bbccec929bab828be

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-alpha_2.4.18-12.tar.gz

Size/MD5 checksum: 24327 1e03b0d75112d8f375edeab10765fc74

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3.dsc

Size/MD5 checksum: 713 17f72349c8729464cf38c1839134ff36

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3.tar.gz

Size/MD5 checksum: 79588 80e54f52ee1c0ead2a66bae306b958eb

Architecture independent components:

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-doc-2.4.18_2.4.18-14.1_all.deb

Size/MD5 checksum: 1719652 cb20d668b1600ddcc336c48ccb02f9ca

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1_all.deb

Size/MD5 checksum: 24132116 8b06d229ce4861b1d4369bc5dec36588

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-patch-2.4.18-powerpc_2.4.18-1woody3_all.deb

Size/MD5 checksum: 79254 eba10131349371c8042ea86d39243fd7

Alpha architecture:

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1_2.4.18-12_alpha.deb

Size/MD5 checksum: 3362894 3d9145e6874b24e55225ba0a37fa1274

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1-generic_2.4.18-12_alpha.deb

Size/MD5 checksum: 3512274 433367fc7750fdf29f61d094cd98b6d0

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-headers-2.4.18-1-smp_2.4.18-12_alpha.deb

Size/MD5 checksum: 3514902 622d609af4f67dd4d0ea807e6f3043f1

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-generic_2.4.18-11_alpha.deb

Size/MD5 checksum: 12425696 27b4defd9326ed5bac3a765977437354

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-alpha/kernel-image-2.4.18-1-smp_2.4.18-11_alpha.deb

Size/MD5 checksum: 12799424 966ecceeb16c5bf87cc31b9178d6add9

PowerPC architecture:

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-headers-2.4.18_2.4.18-1woody3_powerpc.deb

Size/MD5 checksum: 3432832 c74804934655fd3d27f443870d9893e7

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-newpmac_2.4.18-1woody3_powerpc.deb

Size/MD5 checksum: 9452710 cc8fe6e203147668d2ca134e11fa4709

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-powerpc_2.4.18-1woody3_powerpc.deb

Size/MD5 checksum: 10100854 c42c8e8883490f9e1b1d68322ea0fd53

http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.18-powerpc/kernel-image-2.4.18-powerpc-smp_2.4.18-1woody3_powerpc.deb

Size/MD5 checksum: 10345270 de1248a91e076bc51402631b23cf8a5b

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 409-1	security@debian.org
http://www.debian.org/security/	Matt Zimmerman
January 5th, 2004	http://www.debian.org/security/faq

Package	:	bind
Vulnerability	:	denial of service
Problem-Type	:	remote
Debian-specific	:	no
CVE IDs	:	CAN-2003-0914

A vulnerability was discovered in BIND, a domain name server,
whereby a malicious name server could return authoritative negative
responses with a large TTL (time-to-live) value, thereby rendering
a domain name unreachable. A successful attack would require that a
vulnerable BIND instance submit a query to a malicious
nameserver.

The bind9 package is not affected by this vulnerability.

For the current stable distribution (woody) this problem has
been fixed in version 1:8.3.3-2.0woody2.

For the unstable distribution (sid) this problem has been fixed
in version 1:8.4.3-1.

We recommend that you update your bind package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2.dsc

Size/MD5 checksum: 639 ade872aa1e8b6bb0b55bd871207d8a36

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2.diff.gz

Size/MD5 checksum: 31925 cdf79e7828e5de2a4cf8ee8e5062a627

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3.orig.tar.gz

Size/MD5 checksum: 2713120 847ba93d1ac71b94560c002c9f730100

Architecture independent components:

http://security.debian.org/pool/updates/main/b/bind/bind-doc_8.3.3-2.0woody2_all.deb

Size/MD5 checksum: 1290814 37075f1a0c5a674d0dc81696f1043a57

Alpha architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_alpha.deb

Size/MD5 checksum: 999312 ecfa16c08ff20b8d4bcdd6c77c32ed6b

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_alpha.deb

Size/MD5 checksum: 509452 3c7d5b70a191c01417e3df9eb6b889a9

ARM architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_arm.deb

Size/MD5 checksum: 826590 696c53c2e7da00d72de0ddce3e9f0bf3

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_arm.deb

Size/MD5 checksum: 427084 df67dbc243f6a88fe1b80e8774bcb366

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_i386.deb

Size/MD5 checksum: 793732 214489ee9312f15a4a86cc8fccec22a2

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_i386.deb

Size/MD5 checksum: 381988 7a625ae2de5b673d9c3a834826f72526

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_ia64.deb

Size/MD5 checksum: 1285864 81bad842984112df3997702fa06173ec

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_ia64.deb

Size/MD5 checksum: 575890 24d29d3e6f9dd9f67f1b35690ede36f5

HP Precision architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_hppa.deb

Size/MD5 checksum: 921460 1828a8f102cf3fe1953c960147fc2880

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_hppa.deb

Size/MD5 checksum: 475208 166521ce1dbe1d65320b4ba22f7fe659

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_m68k.deb

Size/MD5 checksum: 720658 db9f23af2a807675f221c44c861d7019

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_m68k.deb

Size/MD5 checksum: 362762 2c1981f62b69bb3bdf60dd955155514d

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_mips.deb

Size/MD5 checksum: 926968 63314aa98265e5641eb25a4a47c868d9

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_mips.deb

Size/MD5 checksum: 469896 385520c21f7e8bc43a9b33fe3b19963f

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_mipsel.deb

Size/MD5 checksum: 934550 31bc0a5466e17746ca2b3cbf1795ad53

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_mipsel.deb

Size/MD5 checksum: 470826 df4d17e787078e3fc15cae26062c8b1b

PowerPC architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_powerpc.deb

Size/MD5 checksum: 852052 90e213b330d86b796a2641f974e6b253

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_powerpc.deb

Size/MD5 checksum: 451706 39ea99885a79166a6b0240610c592b87

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_s390.deb

Size/MD5 checksum: 796474 46b7bfab715c81ec87f8dd40e45b2a52

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_s390.deb

Size/MD5 checksum: 386568 a2e71e8e0dd00e49e17298e92895963e

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/b/bind/bind_8.3.3-2.0woody2_sparc.deb

Size/MD5 checksum: 839716 97affc72e8a8a3e3be4c6bbe5b791e6a

http://security.debian.org/pool/updates/main/b/bind/bind-dev_8.3.3-2.0woody2_sparc.deb

Size/MD5 checksum: 408802 99a619d3c9374dd861035f932acc959b

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 408-1	security@debian.org
http://www.debian.org/security/	Martin Schulze
January 5th, 2004	http://www.debian.org/security/faq

Package	:	screen
Vulnerability	:	integer overflow
Problem-Type	:	local
Debian-specific	:	no
CVE ID	:	CAN-2003-0972

Timo Sirainen reported a vulnerability in screen, a terminal
multiplexor with VT100/ANSI terminal emulation, that can lead an
attacker to gain group utmp privledges.

For the stable distribution (woody) this problem has been fixed
in version 3.9.11-5woody1.

For the unstable distribution (sid) this problem has been fixed
in version 4.0.2-0.1.

We recommend that you upgrade your screen package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1.dsc

Size/MD5 checksum: 633 a1e5493005ceaf734b6128766d17a641

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1.diff.gz

Size/MD5 checksum: 60531 7800e904a064adf3c2df56eea63270cc

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11.orig.tar.gz

Size/MD5 checksum: 722396 19572f92404995e7b2dea8117204dd67

Alpha architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_alpha.deb

Size/MD5 checksum: 523248 bc1770274cc8cf05e7035ec84601a43f

ARM architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_arm.deb

Size/MD5 checksum: 480188 a6470b52e0a7ea519e017747267206dd

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_i386.deb

Size/MD5 checksum: 461518 4f787a996b5db04abcf3eaa2f5e4f730

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_ia64.deb

Size/MD5 checksum: 586442 7c8ccf8ff76925018e4eb2e8152bb7b3

HP Precision architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_hppa.deb

Size/MD5 checksum: 500770 7da7c865e32afc18fe1bbd32f5843c4d

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_m68k.deb

Size/MD5 checksum: 450656 96c4270b72b3aacbf68be80140335e24

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_mips.deb

Size/MD5 checksum: 494872 2c6255a232455a547fc35899b8dcd7f3

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_mipsel.deb

Size/MD5 checksum: 494260 b5d3bdc0e7c328d2f9af8e9c2ae28d7d

PowerPC architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_powerpc.deb

Size/MD5 checksum: 484050 be22d939e6d308a039fd25b019dc5bcb

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_s390.deb

Size/MD5 checksum: 474334 4ac4afeb09ec9cb2034383e48aaf097c

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/s/screen/screen_3.9.11-5woody1_sparc.deb

Size/MD5 checksum: 482754 38a376dd775ee0f8df32b84b015a4da3

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 412-1	security@debian.org
http://www.debian.org/security/	Matt Zimmerman
January 5th, 2004	http://www.debian.org/security/faq

Package	:	nd
Vulnerability	:	buffer overflows
Problem-Type	:	remote
Debian-specific	:	no
CVE IDs	:	CAN-2004-0014

Multiple vulnerabilities were discovered in nd, a command-line
WebDAV interface, whereby long strings received from the remote
server could overflow fixed-length buffers. This vulnerability
could be exploited by a remote attacker in control of a malicious
WebDAV server to execute arbitrary code if the server was accessed
by a vulnerable version of nd.

For the current stable distribution (woody) this problem has
been fixed in version 0.5.0-1woody1.

For the unstable distribution (sid) this problem has been fixed
in version 0.8.2-1.

We recommend that you update your nd package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1.dsc

Size/MD5 checksum: 566 d2e27c164d3544a251804570379eb44c

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1.diff.gz

Size/MD5 checksum: 3533 4a7b92e2df684bf7f312e3a827764671

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0.orig.tar.gz

Size/MD5 checksum: 52117 d07741e6323fdeb38a6b4549bca02c53

Alpha architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_alpha.deb

Size/MD5 checksum: 20650 c67cd2e49a3a61649ce5a452d55b05eb

ARM architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_arm.deb

Size/MD5 checksum: 18072 3837139e2a5beba99b59984bb748315d

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_i386.deb

Size/MD5 checksum: 17314 5edd55545dc4a923333a67aea035e095

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_ia64.deb

Size/MD5 checksum: 24434 a538a442a1bb1b7c1cd5ee64096a3a1b

HP Precision architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_hppa.deb

Size/MD5 checksum: 20862 92c12defa016b8a577ddf4fb1d80fdc3

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_m68k.deb

Size/MD5 checksum: 16622 f61ea0df91f69157ef653b406af90871

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_mips.deb

Size/MD5 checksum: 19466 d4d60babdecee2e7612410eb8670b9df

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_mipsel.deb

Size/MD5 checksum: 19470 e9a1e61cd15011fe1a30da782d3c7da9

PowerPC architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_powerpc.deb

Size/MD5 checksum: 18204 fb699d5bb90844990c52495f3863ccfe

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_s390.deb

Size/MD5 checksum: 18212 65c7e34f77ddf46ebc4d10656772d055

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/n/nd/nd_0.5.0-1woody1_sparc.deb

Size/MD5 checksum: 17420 6d172963ca07e2e6ca0a1ab2bf59f67a

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 411-1	security@debian.org
http://www.debian.org/security/	Matt Zimmerman
January 5th, 2004	http://www.debian.org/security/faq

Package	:	mpg321
Vulnerability	:	format string
Problem-Type	:	remote
Debian-specific	:	no
CVE IDs	:	CAN-2003-0969

A vulnerability was discovered in mpg321, a command-line mp3
player, whereby user-supplied strings were passed to printf(3)
unsafely. This vulnerability could be exploited by a remote
attacker to overwrite memory, and possibly execute arbitrary code.
In order for this vulnerability to be exploited, mpg321 would need
to play a malicious mp3 file (including via HTTP streaming).

For the current stable distribution (woody) this problem has
been fixed in version 0.2.10.2.

For the unstable distribution (sid) this problem has been fixed
in version 0.2.10.3.

We recommend that you update your mpg321 package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2.dsc

Size/MD5 checksum: 550 0e042888db6da3811c034b528127b73d

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2.tar.gz

Size/MD5 checksum: 113935 201849972c6465da61f279c2225377f7

Alpha architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_alpha.deb

Size/MD5 checksum: 39008 93a81b94171bd2c5a7c3cef85f110205

ARM architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_arm.deb

Size/MD5 checksum: 35074 d1b94bcd86f68e66ad7e6c2e008560e0

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_i386.deb

Size/MD5 checksum: 34118 a798d7036f087d79bf3b4702dccc8e63

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_ia64.deb

Size/MD5 checksum: 45810 ab85b5c5f50f60007582ce7964db56ed

HP Precision architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_hppa.deb

Size/MD5 checksum: 37354 e2f6d8ed0f24b64969eb1588876b145b

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_m68k.deb

Size/MD5 checksum: 33324 34e91b68511a9a4123970bb8956879c8

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_mips.deb

Size/MD5 checksum: 36836 b463575ae9e297f8ad9acb7bffd98aa9

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_mipsel.deb

Size/MD5 checksum: 36776 2686af3b9923cf0d963caf6d0b16c1ac

PowerPC architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_powerpc.deb

Size/MD5 checksum: 35986 fba1682b26e884a23a96b69aa5191080

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_s390.deb

Size/MD5 checksum: 35330 debb74234e2e5449aea85f240b81a0f6

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/m/mpg321/mpg321_0.2.10.2_sparc.deb

Size/MD5 checksum: 35996 c77e160810d06749eddad6b0aad7bb33

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 413-1	security@debian.org
http://www.debian.org/security/	Martin Schulze
January 6th, 2004	http://www.debian.org/security/faq

Package	:	kernel-source-2.4.18, kernel-image-2.4.18-1-i386
Vulnerability	:	mising boundary check
Problem-Type	:	local
Debian-specific	:	no
CVE ID	:	CAN-2003-0985

Paul Starzetz discovered a flaw in bounds checking in mremap()
in the Linux kernel (present in version 2.2.x, 2.4.x and 2.6.x)
which may allow a local attacker to gain root privileges.

For the stable distribution (woody) this problem has been fixed
in kernel-source version 2.4.18-14.1 and kernel-images versions
2.4.18-12.1 and 2.4.18-5woody6 (bf) for the i386 architecture.

For the unstable distribution (sid) this problem will be fixed
soon with newly uploaded packages.

We recommend that you upgrade your kernel packages. This problem
has been fixed in the upstream version 2.4.24 as well.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

Source archives:

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.dsc

Size/MD5 checksum: 664 fcb4f5a949cd17a2b528762db8c4a33e

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1.diff.gz

Size/MD5 checksum: 67239 0ff7d0053ffbf71a66290081300ff759

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18.orig.tar.gz

Size/MD5 checksum: 29818323 24b4c45a04a23eb4ce465eb326a6ddf2

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-i386_2.4.18-12.1.dsc

Size/MD5 checksum: 1193 cdce7e12e094de51f0c3e8baf0492bac

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-i386_2.4.18-12.1.tar.gz

Size/MD5 checksum: 69900 a8543111fa965097e71112dbd8caa637

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-i386bf/kernel-image-2.4.18-i386bf_2.4.18-5woody6.dsc

Size/MD5 checksum: 656 37430a9bacd8c1b814306d2b0e396498

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-i386bf/kernel-image-2.4.18-i386bf_2.4.18-5woody6.tar.gz

Size/MD5 checksum: 26175 486db2749031dd57f81e70f9a251e452

Architecture independent components:

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-doc-2.4.18_2.4.18-14.1_all.deb

Size/MD5 checksum: 1719652 cb20d668b1600ddcc336c48ccb02f9ca

http://security.debian.org/pool/updates/main/k/kernel-source-2.4.18/kernel-source-2.4.18_2.4.18-14.1_all.deb

Size/MD5 checksum: 24132116 8b06d229ce4861b1d4369bc5dec36588

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3413108 0a6e3d8c65686ab34ba27e7ed79590e0

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-386_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3505080 ac13ca0a917bf9b3d9499a4cc33f1a5d

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-586tsc_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3505652 7004b821ee15a5ede5ca5e42e8a9593f

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-686_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3505770 5ee1efb1e377e836d4bda9d1dab07cdd

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-686-smp_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3506916 44491cbfac2f95289f79d369c2e21e5e

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-k6_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3505548 67d4e91b95ad433ef9fdcd20d5da7875

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-headers-2.4.18-1-k7_2.4.18-12.1_i386.deb

Size/MD5 checksum: 3505798 3365e0518af36585927bf2fb16b1f05f

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-386_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8797862 ce91d7b108975eb6f6ea0650d26a6f78

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-586tsc_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8704152 e9ea2bb7d683421a969af5a25fa43f28

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-686_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8703368 37e7ffaf947195805028bc48a116d333

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-686-smp_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8959818 a4d75382cc604bc1430311d3202be419

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-k6_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8660958 0dc21476d147d35ba5a51c52333a6e5e

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-image-2.4.18-1-k7_2.4.18-12.1_i386.deb

Size/MD5 checksum: 8863054 1c1e0e73a3a21e83272f066003df8035

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-386_2.4.18-12.1_i386.deb

Size/MD5 checksum: 228474 8aaa36501bd381a9818a2d2d8d0fc442

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-586tsc_2.4.18-12.1_i386.deb

Size/MD5 checksum: 228030 28f38795b063394f3c0d23cce2f34563

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-686_2.4.18-12.1_i386.deb

Size/MD5 checksum: 227470 97220060259b9f992d59a535c95115d6

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-686-smp_2.4.18-12.1_i386.deb

Size/MD5 checksum: 231132 c51bc7868477f35c86c2b8223fa7d955

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-k6_2.4.18-12.1_i386.deb

Size/MD5 checksum: 227126 cfc9d2336a1db612bb9ae26991195ed9

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-1-i386/kernel-pcmcia-modules-2.4.18-1-k7_2.4.18-12.1_i386.deb

Size/MD5 checksum: 230386 124ee872623959f72c4782ea68b67afb

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-i386bf/kernel-headers-2.4.18-bf2.4_2.4.18-5woody6_i386.deb

Size/MD5 checksum: 3410416 8098dd830ebaa8c2ba4f0bb1d28be26e

http://security.debian.org/pool/updates/main/k/kernel-image-2.4.18-i386bf/kernel-image-2.4.18-bf2.4_2.4.18-5woody6_i386.deb

Size/MD5 checksum: 6424802 0c281e78d53c6f759a5725d347c894ca

These files will probably be moved into the stable distribution
on its next revision.

Debian Security Advisory DSA 410-1	security@debian.org
http://www.debian.org/security/	Matt Zimmerman
January 5th, 2004	http://www.debian.org/security/faq

Package	:	libnids
Vulnerability	:	buffer overflow
Problem-Type	:	remote
Debian-specific	:	no
CVE IDs	:	CAN-2003-0850

A vulnerability was discovered in libnids, a library used to
analyze IP network traffic, whereby a carefully crafted TCP
datagram could cause memory corruption and potentially execute
arbitrary code with the privileges of the user executing a program
which uses libnids (such as dsniff).

For the current stable distribution (woody) this problem has
been fixed in version 1.16-3woody1.

For the unstable distribution (sid) this problem will be fixed
soon.

We recommend that you update your libnids package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.